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THE NEED FOR INTELLIGENT FLIGHT CONTROL 

Many fatal aircraft accidents appear to be the result of a misuse of informa- 
tion, knowledge, or capability. For instance, a pilot depends on instruments for 
accurate aircraft status information. Inaccurate or partial information deprives 
the pilot of the resources necessary to safely operate the aircraft, and thus 
constitutes a misuse of information. Similarly, negligence or inexperience on 
the part of the pilot represents a misuse of knowledge. Finally, modern generic 
jet aircraft have highly redundant control effectors. As a result, it may be 
possible to counterbalance the effect of a failed primary control effector, such 
as an aileron, with a secondary control effector, such as a trailing-edge flap. 

If an aircraft is controllable following a failure, but through a lack of informa- 
tion, knowledge, or ability the pilot fails to control it, this represents a 
misuse of capability. 


FATAL ACCIDENTS OF U.S. SCHEDULED AIR CARRIERS, 1961-1979 


• Reverse thrust warning light malfunction 
t Landing gear warning light malfunction 

• Loss OF electrical system to attitude instruments 

• Turbulence, airframe failure in flight 

• Hydraulic pressure loss uncorrected by pilot 

• Hydraulic system degradation 

• Rudder support material failure 

• Rudder control system malfunction 

• Flight control system failure 

• Failure of engine pylon 
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RESEARCH OBJECTIVES 


The objective of this research is to use artificial intelligence techniques , 
along with statistical hypothesis testing and modern control theory, to help the 
pilot cope with the issues of information, knowledge, and capability in the event 
of a failure. We are developing an "intelligent" flight control system which 
utilizes knowledge of cause-and-ef feet relationships between all aircraft com- 
ponents. It will screen the information available to the pilot, supplement his 
knowledge, and most importantly, utilize the remaining flight capability of the 
aircraft following a failure. The list of failure types the control system will 
accommodate includes sensor failures, actuator failures, and structural failures. 


PURPOSE 


• TO INVESTIGATE THE POSSIBLE CONTRIBUTION OF ARTIFICIAL 
INTELLIGENCE TECHNIQUES TO AIRCRAFT FAILURE DETECTION, 
IDENTIFICATION, AND RECONFIGURATION (FDIR) 


MOTIVATION 

• MOST EXISTING FDIR SCHEMES CAN HANDLE ONLY A SUBSET OF 
ALL POSSIBLE AIRCRAFT FAILURES 

• FEW EXISTING FDIR SCHEMES INCORPORATE HUMAN-LIKE COMMON 
SENSE OR KNOWLEDGE RELATING ALL AIRCRAFT COMPONENTS 

• REDUNDANCY IN MODERN AIRCRAFT MAY PERMIT RECOVERY FROM 
SEVERE FAILURES 
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ASSUMPTIONS 


In order to adapt to significant failure-induced changes in the configuration 
of the aircraft, the control system must have a variable structure. A fly-by-wire 
flight control system can be reconfigured by supplying new mathematical models and 
gains to the computer, thus a control system of this form is assumed. Note that the 
pilot flies the aircraft via the flight computer and has no direct link to the con- 
trol surfaces. It is essential, therefore, that the flight computer have the model 
and gains corresponding to the actual aircraft configuration. Assuming that a 
failure will significantly change the configuration, it will be the job of the 
knowledge-based reconf igurable flight control system (KBRFCS) to replace the pre- 
failure model with the correct model. 


BASIC FLY-BY-WIRE FLIGHT CONTROL SYSTEM 
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A PROCEDURE FOR INTELLIGENT FAILURE MANAGEMENT 

One method of dealing with the problem of failure detection, identification, 
and reconfiguration (FDIR) is the following. The KBRFCS supervises aircraft behavior 
until some abnormality occurs, at which time a failure alert is given. The system 
then allocates its resources to best serve the problem-solving process. This will 
be important if implementation requires a multi-microprocessor environment. Next, 
the system tries to diagnose exactly what has failed. Concurrently, immediate and 
temporary measures are taken to help reduce the effect of the failure during diag- 
nosis. An example of such compensation would be the deflection of a flap to offset 
a sudden, unexplained roll. When the failure is identified, the best control con- 
figuration given the present circumstances is chosen and reconfiguration begins. 
Finally, the new control scheme is implemented. 
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FAILURE DETECTION AND DIAGNOSIS PROBLEMS 


The easiest way to detect and identify a sensor failure is to compare three 
sensors which measure the same quantity. Such a triplex system can be very expen- 
sive, however. In the less expensive duplex system a failure is easy to detect but 
hard to identify. Functional redundancy between unique sensors can be exploited to 
further reduce costs. For example, a rate gyro and an accelerometer can each provide 
pitch rate information; therefore, the signals can be compared to detect a failure 
in one of the two components. Although seemingly straightforward, these FDI tech- 
niques can run into problems. Consider a triplex system in which two of the sensors 
are powered from one electrical source and the third sensor from a different source. 
If the triplex FDI scheme identified a failure by singling out the one sensor which 
differed from the other two, a power failure to the first two sensors would be mis- 
construed as a failure of the third. This brings up the need for the incorporation 
of intelligence into the failure diagnosis process, an intelligence which will 
recognize when such "higher-order” relations among different elements of the air- 
craft exist. 


Direct Redundancy 



compare 


Duplex 



Functional Redundancy 


RATE GYRO ACCELEROMETER 



COMPARE 


67 





SOME EXISTING FAILURE DETECTION AND DIAGNOSIS SOLUTIONS 


When the attempt is made to detect and diagnose all types of failures, not 
simply sensor failures, it is necessary to use all the analytical redundancy avail- 
able. The generalized likelihood ratio (GLR) method and the multiple model (MM) 
method are two algorithms which use this redundancy to choose, from a finite set of 
alternatives, the mathematical model which best predicts the actual aircraft 
behavior. In FDI the set of alternatives would be the set of failures one hopes 
to detect and identify. The GLR method is well suited to failure detection, while 
the MM method is more effective at failure identification. Therefore, one way to 
accomplish FDIR would be to first detect a failure with the GLR, then run the MM 
algorithm to choose the proper model from the set of all possible failure models. 


GENERALIZED LIKELIHOOD RATIO CGLR) METHOD 


Basis 

Different abrupt changes produce different effects on filter innovations 
Advantages 

• Likelihood calculations based on single nominal Kalman Filter 

• With magnitude of failure known,, simplified GLR (SGLR) results in very 
low computational load 

• Effectively detects abrupt changes 
Disadvantages 

• Accommodates additive effects on single nominal model only 


MULTIPLE MODEL (MM) METHOD 

Operation 

• Observe u(k) and y(k) 

• Choose most likely model from finite set of hypotheses 

• Recursive probability formula from Bayes' Rule 

Advantages 

• Allows parametric as well as additive changes 

• Compares models of different order 

• Robust to non-Gaussian statistics 

Disadvantages 

• High computational burden 

• Bank of Kalman Filters 

• Switch detection requires growing number of filters 

• Slow response to model switches 
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AN ALTERNATE SOLUTION 


The KBRFCS will be expected to handle many types of failures. Each failure 
will change the aircraft configuration in a unique way and will therefore have a 
unique model associated with it. If the previously mentioned FDIR scheme is 
employed, the MM algorithm will be required to choose from among thousands of 
models. Although this may be a theoretically feasible solution, it will require 
an immense amount of computing power. Our goals include eventual implementation 
and flight testing of the control system, and computer resources must be kept to a 
minimum. If there was a way to let the MM algorithm test only those models corre- 
sponding to failures which are most likely under the circumstances, the required 
computer speed could be drastically reduced. In the KBRFCS, this important diag- 
nostic tool takes the form of an expert system. 
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THE EXPERT SYSTEM 


The job of the expert system is to narrow down to a reasonable number the list 
of possible failures to be tested by the MM algorithm. When a sensor value goes 
beyond a prespecified warning level, or if it jumps too quickly, or if a state or 
observation bias jump is picked up by the GLR, a failure is detected and this 
information is passed on to the expert system. With knowledge of the cause-and- 
effect relationships among all aircraft components and common-sense failure 
diagnosis rules, the expert system decides which failures are most likely to have 
occurred. 
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THE GLOBAL DATA BASE AND THE RULES 


The aircraft relational knowledge is contained in the global data base. The 
rules combine this knowledge with heuristic, common-sense reasoning to diagnose a 
failure. The following example illustrates the type of rules the expert system 
contains. 


Rule If a sensor (such as an aileron position sensor) has exceeded its 

#1 expected value and that sensor senses an effector (such as an aileron) 

and no states (including roll rate) have exceeded their expected values 
then - a sensor failure is likely and an electrical support (for that 
sensor) failure is likely. 

Rule I_f a sensor has exceeded its expected value and that sensor senses an 
#2 effector and that effector strongly effects a state which has exceeded 
its expected value 

then - an effector failure is likely. 


These rules show how the expert system can distinguish between a failed effector 
which is sensed and a failed sensor. 


I 

KBRFCS GLOBAL DATA BASE 
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KNOWLEDGE- BAS ED RECONFIGURABLE FLIGHT CONTROL SYSTEM 


Although the expert system contains many rules, only a small number of them 
will be pertinent to a given failure at a given point in the diagnostic process. 

For example, if a failure is detected and no state bias jumps were observed by the 
GLR test, the expert system should not waste time testing rules which depend on the 
existence of a state bias jump in order to be true. The "rule interpreters" pro- 
vide the control structure needed to select the appropriate rules to be tested. 

With the expert system complete, the KBRFCS becomes an intelligent and valuable 
mechanism capable of accommodating failures that a pilot may not be able to handle 
alone. 
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RESEARCH WORK SCHEDULE 


• Theoretical development 

• Nominal Model Selection 

• Failure set generation 

• Gain calculation 

• Knowledge generation through GLR, SGLR, 

AND MM TESTING 

• General rule development 

• Global data base development 

• Specific rule development 

• Rule interpreter development 

• Multi-microprocessor simulation 
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